CVE-2024-22836

—

CVSS 3.1

9.8 critical

EPSS

30%p98

Published

Feb 8, 2024 (Feb 8, 2024)

Modified

Jun 17, 2026

Description

An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. An attacker can manipulate the company locale when installing an app to execute system commands on the hosting server.

Vendors: akaunting
Products: akaunting
Weakness: CWE-78
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (30.0%)

In the news0 stories

No ingested article mentions this CVE yet.